JA4
A next-generation TLS fingerprinting scheme proposed by FoxIO in 2023. It generates fingerprints by computing structured hashes over fields within TLS ClientHello handshake messages, enabling identification of client TLS implementation characteristics. It has been integrated into security tools including Suricata and Zeek.
Timeline (last 90 days)
Modern WAFs (such as Cloudflare, Akamai, AWS WAF) evaluate not only the IP but also TLS fingerprints (JA3/JA4), HTTP/2 frame order, header field order and consistency, cookie behavior, and frontend signals.
NetWatch provides real-time decoding, display filters, flow tracking, JA4 fingerprinting, and PCAP export at the packet level.
JA4 is a next-generation TLS fingerprinting scheme proposed by FoxIO in 2023 to replace the previously widely used JA3.
JA4 has been widely integrated into security tools such as Suricata and Zeek for identifying malware communication patterns.
Crawlers can be identified through behavioral analysis, request fingerprinting (TLS fingerprints JA3/JA4, HTTP header ordering), and honeypot traps.
All Facts (7)
Cloudflare通过TLS指纹（JA3/JA4）、HTTP/2帧顺序、浏览器JavaScript API、Canvas/WebGL渲染指纹等多维度指纹识别来区分真人与机器人
85%UnverifiedJA4 is an evolved version of JA3 released by FoxIO in 2023, adopting finer-grained feature extraction and a more flexible hash structure.
60%UnverifiedModern WAFs (such as Cloudflare, Akamai, AWS WAF) evaluate not only the IP but also TLS fingerprints (JA3/JA4), HTTP/2 frame order, header field order and consistency, cookie behavior, and frontend signals.
50%UnverifiedNetWatch provides real-time decoding, display filters, flow tracking, JA4 fingerprinting, and PCAP export at the packet level.
50%UnverifiedJA4 is a next-generation TLS fingerprinting scheme proposed by FoxIO in 2023 to replace the previously widely used JA3.
50%UnverifiedJA4 has been widely integrated into security tools such as Suricata and Zeek for identifying malware communication patterns.
50%UnverifiedCrawlers can be identified through behavioral analysis, request fingerprinting (TLS fingerprints JA3/JA4, HTTP header ordering), and honeypot traps.
50%